I have the need to use different default-routes depending on the source-address of the packet, when it comes from the content switch (e.g. from a group-address or as response-packet in a conversation with
a content address).
The reason for this requirement ist, that I have one firewall which is connected to both vlan2 and vlan602.
First there are rules, which disallow some traffic between 128.111.1.0 and 128.222.2.0. (addresses are only examples !!)
Second there occurs a routing-triangle which results
in blocking of path through the (statefull) firewall because the firewall sees no completion of the tcp 3-way handshake.
I tried this configuration but it does not work.
Pakets from 128.222.2.x adresses to 128.111.1.x adresses are send directly to the destination because the address in the arp-cache of the content switch.
any ideas ??
ip route 0.0.0.0 0.0.0.0 128.111.1.1 1
ip route 0.0.0.0 0.0.0.0 128.222.2.1 1
!************************* INTERFACE *************************
interface 1/1
trunk
vlan 2
vlan 602
!************************** CIRCUIT **************************
circuit VLAN2
ip address 128.111.1.101 255.255.255.0
ip virtual-router 2 priority 254 preempt
ip redundant-interface 2 128.111.1.100
circuit VLAN602
ip address 128.222.2.101 255.255.255.0
ip virtual-router 102 priority 254 preempt
ip redundant-interface 102 128.222.2.100
